OCSP: disabled handling of headers without a colon

Header names not followed by a colon and a value in an OCSP responder
reply were accepted as headers with an empty value, similarly to
ngx_http_parse_header_line().  With this change, such headers are
rejected with the "OCSP responder sent invalid response" error, and the
response is not used.

The problem appeared in 74ad4494a (1.3.7).

diff --git a/src/event/ngx_event_openssl_stapling.c b/src/event/ngx_event_openssl_stapling.c
index 86d8b2c5576defa9fb17b819f7be056d2751daa5..4f91c9193d1e08b382a251300a5b1eb33cd6daee 100644 (file)
--- a/src/event/ngx_event_openssl_stapling.c
+++ b/src/event/ngx_event_openssl_stapling.c
@@ -2237,21 +2237,6 @@ ngx_ssl_ocsp_parse_header_line(ngx_ssl_ocsp_ctx_t *ctx)
                 break;
             }
 
-            if (ch == CR) {
-                ctx->header_name_end = p;
-                ctx->header_start = p;
-                ctx->header_end = p;
-                state = sw_almost_done;
-                break;
-            }
-
-            if (ch == LF) {
-                ctx->header_name_end = p;
-                ctx->header_start = p;
-                ctx->header_end = p;
-                goto done;
-            }
-
             return NGX_ERROR;
 
         /* space* before header value */